Add Haven's services to Dimaga

bin/install-nixos.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Script to install a brand new NixOS installation.
+# Formats the drive provided, then runs nixos-install.
+
+set -e
+
+# Configuration parameters
+ask_root_password=true	# Prompt for a root user password
+flakeDir="."			# Where the flake.nix file is stored
+boot_drive="/dev/disk/by-uuid/whatever"	# The drive to install the bootloader to
+root_drive="/dev/disk/by-id/whatever"	# The partition to install NixOS to
+
+if [ "$(id -u)" != "0" ]; then
+   echo "This script must be run as root" 1>&2
+   exit 1
+fi
+
+cryptsetup --allow-discards --label=nixos-crypt --type=luks2 luksFormat $root_drive
+cryptsetup luksOpen $root_drive nixos-crypt
+mount /dev/mapper/nixos-crypt /mnt
+mkfs.btrfs -L nixos /mnt
+btrfs subvolume create /mnt/@
+btrfs subvolume create /mnt/@home
+btrfs subvolume create /mnt/@log
+btrfs subvolume create /mnt/@nix
+btrfs subvolume create /mnt/@swap
+umount /mnt
+
+mount -o subvol=@ $root_drive /mnt
+mkdir -p /mnt/{boot,home,var/log,nix,swap}
+mount $boot_drive /mnt/boot
+mount -o subvol=@home $root_drive /mnt/home
+mount -o subvol=@log $root_drive /var/log
+mount -o subvol=@nix $root_drive /mnt/nix
+mount -o subvol=@swap $root_drive /mnt/swap
+
+# Create swapfile
+btrfs filesystem mkswapfile --size $(free -h --si | grep Mem: | awk '{print $2}') --uuid clear /mnt/swap/swapfile
+
+nixos-install --verbose --root /mnt --flake $flakeDir $( (( ask_root_password == false )) && echo "--no-root-password" )
+
+exit 0
+

hosts/Dimaga/default.nix

@@ -8,6 +8,28 @@
 let
   # Do not change this value! This tracks when NixOS was installed on your system.
   stateVersion = "24.11";
+
+  start-services = pkgs.writeShellScriptBin "start-services" (
+    builtins.readFile ../Haven/start-haven.sh
+  );
+
+  services-root = "/storage/services";
+
+  subdomains = [
+    config.secrets.services.airsonic.url
+    config.secrets.services.cache.url
+    config.secrets.services.forgejo.url
+    config.secrets.services.gremlin-lab.url
+  ];
+
+  namecheapCredentials = {
+    "NAMECHEAP_API_USER_FILE" = "${pkgs.writeText "namecheap-api-user" ''
+      ${config.secrets.networking.namecheap.api.user}
+    ''}";
+    "NAMECHEAP_API_KEY_FILE" = "${pkgs.writeText "namecheap-api-key" ''
+      ${config.secrets.networking.namecheap.api.key}
+    ''}";
+  };
 in
 {
   imports = [ ./hardware-configuration.nix ];
@@ -28,6 +50,7 @@ in
 
     apps = {
       development.enable = true;
+      tmux.enable = true;
       #media.enable = true;
       #office.enable = true;
       #recording.enable = true;
@@ -38,7 +61,7 @@ in
     # Enable Secure Boot support.
     bootloader = {
       enable = true;
-      #secureboot.enable = true;
+      secureboot.enable = true;
       tpm2.enable = true;
     };
 
@@ -58,17 +81,113 @@ in
       };
     };
 
+    packages = [
+      start-services
+      pkgs.htop
+    ];
+
     # Change how long old generations are kept for.
-    retentionPeriod = "14d";
+    retentionPeriod = "monthly";
 
     services = {
-      autoUpgrade = {
+      acme = {
         enable = true;
+        defaultEmail = config.secrets.users.aires.email;
+        certs = {
+          "${config.secrets.networking.primaryDomain}" = {
+            dnsProvider = "namecheap";
+            extraDomainNames = subdomains;
+            webroot = null; # Required in order to prevent a failed assertion
+            credentialFiles = namecheapCredentials;
+          };
+          "${config.secrets.networking.blogDomain}" = {
+            dnsProvider = "namecheap";
+            webroot = null; # Required in order to prevent a failed assertion
+            credentialFiles = namecheapCredentials;
+          };
+        };
+      };
+      apcupsd = {
+        enable = true;
+        configText = builtins.readFile ../Haven/etc/apcupsd.conf;
+      };
+      airsonic = {
+        enable = true;
+        home = "${services-root}/airsonic-advanced";
+        domain = config.secrets.networking.primaryDomain;
+        url = config.secrets.services.airsonic.url;
+      };
+      autoUpgrade = {
+        enable = false; # Don't update the system...
+        pushUpdates = true; # ...but do push updates remotely.
         configDir = config.secrets.nixConfigFolder;
         onCalendar = "daily";
         user = config.users.users.aires.name;
       };
-      virtualization.enable = true;
+      boinc.enable = true;
+      cache = {
+        enable = false; # Disable for now
+        secretKeyFile = "${services-root}/nix-cache/cache-priv-key.pem";
+      };
+      duplicacy-web = {
+        enable = true;
+        autostart = false;
+        environment = "/storage/backups/settings/Haven";
+      };
+      forgejo = {
+        enable = true;
+        home = "${services-root}/forgejo";
+        domain = config.secrets.networking.primaryDomain;
+        url = config.secrets.services.forgejo.url;
+        actions = {
+          enable = true;
+          token = config.secrets.services.forgejo.runner-token;
+        };
+      };
+      msmtp.enable = true;
+      nginx = {
+        enable = true;
+        autostart = false;
+        virtualHosts = {
+          "${config.secrets.networking.primaryDomain}" = {
+            default = true;
+            enableACME = true; # Enable Let's Encrypt
+            locations."/" = {
+              # Catchall vhost, will redirect users to Forgejo
+              return = "301 https://${config.secrets.services.forgejo.url}";
+            };
+          };
+          "${config.secrets.networking.blogDomain}" = {
+            useACMEHost = config.secrets.networking.blogDomain;
+            forceSSL = true;
+            root = "${services-root}/nginx/sites/${config.secrets.networking.blogDomain}";
+          };
+          "${config.secrets.services.gremlin-lab.url}" = {
+            useACMEHost = config.secrets.networking.primaryDomain;
+            forceSSL = true;
+            locations."/" = {
+              proxyPass = "http://${config.secrets.services.gremlin-lab.ip}";
+              proxyWebsockets = true;
+              extraConfig = "proxy_ssl_server_name on;";
+            };
+          };
+        };
+      };
+      ssh = {
+        enable = true;
+        ports = [ config.secrets.hosts.haven.ssh.port ];
+      };
+      virtualization = {
+        host = {
+          enable = true;
+          user = "aires";
+          vmBuilds = {
+            enable = true;
+            cores = 3;
+            ram = 4096;
+          };
+        };
+      };
     };
 
     ui = {
@@ -83,8 +202,6 @@ in
         # Define Flatpak packages to install.
         packages = [
           "com.github.tchx84.Flatseal"
-          "com.github.wwmm.easyeffects"
-          "md.obsidian.Obsidian"
           "org.keepassxc.KeePassXC"
           "org.mozilla.firefox"
         ];
@@ -96,8 +213,7 @@ in
       services = {
         syncthing = {
           enable = true;
-          autostart = true;
+          autostart = false;
-          enableTray = false;
         };
       };
     };